108544 matches found
CVE-2026-19074
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...
EUVD-2026-54998
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...
CVE-2026-19074 Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...
CVE-2026-19074
CVE-2026-19074 affects the Advanced Classifieds & Directory Pro WordPress plugin prior to 3.4.3 (
EUVD-2026-54962
A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...
Vulnerability of the prepare_form() function in the acfe_module_form_front.render plugin: This vulnerability allows a hacker to execute arbitrary code.
Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2026-19374
CVE-2026-19374 affects the adafap api-mcp Proxy API Endpoint, specifically the customAxios function in app/api/proxy/route.ts. The issue arises from manipulation of the url argument, causing server-side request forgery (SSRF). Exploitation is described as remote. Documents consistently note a rol...
nuclei v3.11.1
English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...
CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
CVE-2026-19359
The CVE affects nxp-auto-goldvip gvip up to 1.4.0, specifically the SitewiseCustomFunction in the Lambda Function Handler. The issue enables improper access controls and can be exploited remotely. A fix is available in version 1.15.0; upgrading the affected component is advised. The accompanying ...
EUVD-2026-54930
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...
Security Bulletin: L7 intention authorization bypass via custom public listener
Summary Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention...
CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
JLSEC-2026-1207 Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request...
Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second reques...
CVE-2026-15970
Summary: CVE-2026-15970 affects Consul Community Edition 1.20.1–2.0.2 and Consul Enterprise; an L7 intention authorization bypass occurs when a service proxy uses a custom public listener, allowing an authenticated mesh workload to access HTTP paths blocked by a path-based deny intention. Impact ...
CVE-2026-15970 L7 intention authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
EUVD-2026-54611
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CVE-2026-15970 L7 intention authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...